Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
sigma Suspicious High IntegrityLevel Conhost Legacy Option test 2024-12-01
sigma Setup16.EXE Execution With Custom .Lst File test 2024-12-01
sigma UAC Bypass Abusing Winsat Path Parsing - Process test 2024-12-01
sigma Potential Privilege Escalation via Service Permissions Weakness test 2024-12-01
suricata ET HUNTING http string in hex Possible Obfuscated Exploit Redirect rev 4 2024-11-29
suricata ET HUNTING Possible RTF File With Obfuscated Version Header rev 4 2024-11-29
snort ET TROJAN Nivesro Cheat CnC Activity M1 rev 3 2024-11-28
snort ET TROJAN MSIL/Adload.AT Beacon rev 7 2024-11-28
snort ET TROJAN RelevantKnowledge Adware CnC Beacon rev 4 2024-11-28
snort ET TROJAN DealPly Adware CnC Beacon 2 rev 4 2024-11-28
snort ET TROJAN W32/RocketfuelNextUp.Adware CnC Beacon rev 4 2024-11-28
snort ET TROJAN W32/InstallRex.Adware Report CnC Beacon rev 3 2024-11-28
snort ET TROJAN W32/Stan Malvertising.Dropper CnC Beacon rev 3 2024-11-28
snort ET TROJAN NivesroCheat CnC Activity M2 rev 3 2024-11-28
snort ET TROJAN PUP TheSZ AutoUpdate CnC Beacon rev 3 2024-11-28
snort ET TROJAN W32/InstallRex.Adware Initial CnC Beacon rev 3 2024-11-28
snort ET TROJAN SoundCloud Downloader Install Beacon rev 3 2024-11-28
snort ET TROJAN W32/PicColor Adware CnC Beacon rev 3 2024-11-28
snort ET TROJAN PUP Win32/Conduit.SearchProtect.O CnC Beacon rev 3 2024-11-28
snort ET TROJAN W32/PullUpdate.Adware CnC Beacon rev 6 2024-11-28
snort ET TROJAN DealPly Adware CnC Beacon 3 rev 3 2024-11-28
snort ET TROJAN MALWARE W32/WinWrapper.Adware POST CnC Beacon rev 3 2024-11-28
snort ET TROJAN DealPly Adware CnC Beacon 4 rev 3 2024-11-28
snort ET TROJAN W32/Softpulse PUP Install Failed Beacon rev 3 2024-11-28
snort ET TROJAN DealPly Adware CnC Beacon rev 5 2024-11-28
snort ET WEB_SERVER Possible SQL Injection Using MSSQL sp_configure Command in HTTP URI rev 6 2024-11-28
suricata ET WEB_SERVER Possible SQL Injection Using MSSQL sp_configure Command in HTTP URI rev 6 2024-11-28
snort ET INFO DYNAMIC_DNS HTTP Request to a *.600912 .com domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS HTTP Request to a *.mechtronics .net Domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS Query to a *.pchelp-24 .com Domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS Query to a *.manoahinvest .com Domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS HTTP Request to a *.daustin .com domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS HTTP Request to a * .bamapos .com Domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS HTTP Request to a * .20pack .com Domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS HTTP Request to a *.rustyfoundation .com domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS HTTP Request to a * .iziliang .com Domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS Query to a *.fullsense .com .br Domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS HTTP Request to a * .lecreativity .com Domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS Query to a * .grantmaskell .com Domain rev 2 2024-11-27
snort ET INFO DYNAMIC_DNS HTTP Request to a * .ridespirals .com Domain rev 2 2024-11-27